StrongSwan

From NTA-Wiki

Jump to: navigation, search

anne movie rice standards and learning expectations explicit instruction bextra side effects little old church page info on serial killers amoxicillin does work http web server security pinckney pirate football german sheperds for sale pawkiness metropolis metrotown movies boys jacking grow cabinet real estate in tampa bay nokia 3300 ringtones star trek movies list star charts ringtones composing codes registarion plates french garden furniture kaylani lei video free cheap replica watches alcohol clearinghouse drug information national average pharmacy tech salary severance agreement eye candy 4000 demo crack its a good day to die movie quote fig preserves nu ma nu ma iei video sentinel echo london kentucky licensed child care sanctimony movie impotency black poets movie theater columbia south dakota car cleaning kit candle gifts movie gods and monsters whitney houston drug addiction oldmovie ontario drug formulary playing mp4 movies house insulation ashampoo winoptimizer platinum suite 2 2.1 crack healthcare solutions software asian guy fuck u2 ticket window open asp nc liquor license playing black jack rasmol downloads anastacia torrent mp3 free music download pump it up dvd torrent oxygen phone manager crack 2.7 anime dvds ipod photo put video discount software shizzle suzana mancic video snimak hot teen guy index landstar.com yala national park tsunami index top foreign dating service young lolita south park the movie songs rodrigues virginia sword and sandal movie stephane only you 112 video learning drum kit ottomans ephedra sinica extract site pecker point to point video conferencing software gm71c4400bj70 map pacific fuses teen girl naked masturbation movie teen jasper the parrot video star trek videos hp laser cartridges spekerphone movie review kiss kiss bang scart to s video black and white etensity videos legend movie street iruvar movie myspace video codes maxwell fortunate stewie family guy rocket man video 600 ringtone software treo state college pa movie north scottsdale real estate inaguration parade video vida guerra naked leftover crack super tuesday movie musashi enzymes cellular respiration woman vest town of raymond ayushman serial medical training video womens heels map tafe queensland aam ambercrombie gta vice city gravidas monte python movies lesbian panties marchen awakens romance torrent cost of adderall prescriptions dog humping woman jonah falcon video eckard drug store locations aisha funny videos teen sex stories adshareit swf to video converter crack diary of a mad black woman office 2004 cracks robotrage pamela anderson brett michaels movie madagascar movie watch erect locating a church in the netherlands data cd duplication listec video antonvideo biome coral reef super blackjack 5.8 serial phacks svefn g englar music video snap change video free motorola music ring ringtone tone tone latin america pacesetter free motorola razr ringtone v3c ai artificial intelligence movie shroders investment bank mastubation video clips domain ut austin library catalog top online horse games atlantic conveyor alaska erestor and glorfindel rupaul video looking good feeling gorgeous dog food newmans own mixing ambien and lunesta torton bodies massari ft. loon video index artocracy.org orgasm stories shakeela uncensored movie sony centrino laptop replacement seat foam professional cleaning supply social democracy in sweden dildo party movie shorts leadership games 1969 mustang mach 1 project car for sale ebert roper movie review parkview ford montevideo mn maxtor diamondmax plus 9 80gb hard drive steamboat springs city mpich rsh used hard to find books mud oreo pie recipe seventeen girls url lake erie walleye charters porn preview video xxx men baquacil antiviral drug beach front homes gulf breeze hunter x hunter mp3 behr.com suikoden videos microsoft player video morphine drug interactions http steve bridges video tkg consulting engineers inc. saturday night live rap video legalizing drugs and economy natasha bedingfield music video code levitra drugs nystagmus videos side effects fish oil menores mike hotts video mini sp always video blink 182 ernest rutherford agreement licensee site kylie come into my world video movies to come out sittin at a bar bmx street kids party ideas valentines day web cam free ware fairy clipart tom sells myspace link 2 pac lost soul t190 ringtones dr painted sandal scholls razr video phone polyphonic ringtones nokia 6610i michelle phillips federal air marshal music torrent download map liv tyler nude movie iowa caucus free beatles ringtone live oak tree near fulton wooden play yards young teen girls gorean making of movie troy index ocean breeze phuket movie trading cards phantom grilles musicology prince video time clock of the heart lyrics the langer song sphere movie ending addiction alcohol drug services mlfs http prodad crack aristotles ideal state right now music video van halen webmap oopps celebs lao 2003 530i bmw picture top absolutely free orgy video xxx erb graduate caller hotlink com my ringtone pussy insertion license plate frame sayings kidneythieves torrent movie lines from the notebook ctu phone ringtone verizon music robot video apple dvi to video adapter uk pump up the volume movie quotes julie strain video clips being job physics degree brittany sky fishing rod sitemap arabic clip free song video target drug delivery up skirt butt free milf sex anime on dvd magneta lane video canopy rental jump rope asian movie thumbnails dick suck video lcd color video monitor pinnacle videos ejercicios excel super bowl video commercials movie sc seneca theater macgyver tv movie alicia key song lyric program cracks hacks tip on fl studio aloha ailines aviation accident videos rebirth rb 338 crack links galleries of jana cova making love videos free calgary real estate samsung a650 ringtones verizon listen to your heart music video code smoking teen video newspaper socialist age of empires 2 the conquerors crack miami movie rating vice neighborhood 1 new orleans indian movie trailors orange sky raven shield lan crack sex in mainstream movies wood wine racks erotica orgasm sapphic video investor relations new york map quotes from friday night lights the movie icuii 7.0 serials army tales sodo muffin recipes zendor group strongbad mika tan gallery link scrapbook kits ephedra products in mexico american beverage licensees burn cd balloon jump adult bit site torrent barbed wire tattoos johnny depp 2005 movies dirt bike crashes movie own pick paycheck calculator audiocatalyst crack url antares design sierra extra large hoop earrings in jersey job new nursing titanium production http hot gallery pics multiple sclerosis video yoga josie bisset domain national survey on drug use and health 2002 free printable graduation invitations scissor-lift mechanisms safety training video for box cutting knives mdm zinc v2 crack esar evan follow never free ringtone for nokia cingular phone adult free home movie kiyone porn guys video spanking images movies teva clonazepam custom truck rim cuffs eiffel 65 video code imam ali movie download milf trixie bunnyteens.com movie sonny free hentai inuyasha louis vuitton serial numbers itemized deduction limit 2004 map joss stone torrent download using substring in java liquid edition 5.5 crack real producer plus 10 serial city stages la tortura music video azeala trail run atl movie.com milton new pharmacy york stan getz movie ending ringtone sonidos univision tiger woods wife pic psc wireless ringtones christian book distributor yahwehs new moons kindom of heaven the movie brinks home security keith american idol video evening grimsby telegraph inspirational vase recording phone calls johnny depp first movie postmodernism music videos aciphex phentermine alprazolam online pharmacy squad 51 ringtone what is cadmium plating golf sport shirts obtaining a federal firearms license gay fisting map simpson piano hinges calgary flames movies at mount pleasant sc data recovery specialists phone headset system knights old republic 2 torrent london drugs photo processing weldneck flanges shenandoah university pharmacy vinyl pergolas land of the dead official movie site let it ride car rental italy mountain view high school bend oregon event inspiration wedding ibanez serial number lookup skyhigh themovie avg antivirus 7.0 crack free ringtone for prepaid nokia phone anna kournikova free video links art history video memphis bleek video odyssey bmx part genealogy.com sequoia parts webmap jongens webmap hollbach aviation accidents videos goth fuck abuse drug elderly prescription aramis 900 deodorant iraq war videos download sango hentai wax surfboard khan zaheer robot animated movie talus caves web too many niggas lyrics ludacris supervisory development program labor and delivery drug azures torrent program palm video player free index ucbi.com hat embroidery michigan cabins consolidation loan debt reduction restrict access to folders swiss gear air mattress here meadville movies japanese uniform employee moral motivation scooby doo sex playstation 2 cheats chiropractor tulsa popup stopper pro serial port kelang malaysia american dad torrent download september 11th video clip search engine for audio video amidala kink 102 portland short free adult movie online maps florida links trailer trash woman web leather motorcycle clothing perimeter pointe movie times la pelotona video linux vs windows its a fine fine day lyrics tan tian luh lovers caught on tape clips adult gallery mpg video japaneese flower drawings online massage package alice ogura free movie new bible black torrent loy movie myrna www.dogpile.co.uk movie industry and investment bank team ddu ebooks teen skirt pool liner san diego landscape valassis movie stars homes tours hoya plant mpaa movie rating system lasik video download merrit mountain music fest healthcare savings kinney drug stores the birth order effect unique wedding floral design tela no-tejida de polipropileno morphine effect on the body r rated movie clip cindy crawford nude potala palace lhasa home young russian pussy pendot drivers license pukar movie movie showtimes and tickets romeo and juliet video clips amc movie theaters in philadelphia u2 crumbs 2hearts ever free web coatings schindlers list movie summary periodontist new jersey monkey kung fu video physical examination 2005 female filmmakers in previews for movies realtors.com website girls piss womens locker room extrait videos logging pollution production siberia video water angels and demons movie pedicure spa movie thirteen script powerbullet keygen abilify drug real ringtones nextel ashampoo movie shrink and burn 2 crack ebony teen video clip online consultation adderall nokia 3gp video converter longevity hgh james king associated bush katrina press video blonde men transmetal tab url sending email to multiple r.j safety sitemap microsoft reader activation for pocket pc discharge athletics game game sports video opencanvas 3 serial india mother movie narnia movie photo melchizedek nj physician assistant license website pregnant cunt web north carolina electrician license philosophical movies flexible circuit assembly bulk candy machines london pharmacy training and education sitemap here nova scotia department of education student loans sunny mackay epilation materiel sourcil license bureaus in ohio link arielle kebbel bio registry mechanic 4 crack download new york radio stations the assassin bug celebrities gone wild live video soccer usa soccer match excel worksheet password crack www http x15 movie theatre show times latino sexy women injection kycera ringtones superfuzz the movie new york drug dealer kadhal rojave movie macgyver theme song ringtone movie studio logo intercessors for america il driver license facility enema video by the collector northern magic factoring receivables picture from the gia movie big_naturals antimycobacterial drugs rolex watch repair legoland california video link idefix movies smoking xanax female supremacy domain art prints bakeries movie in charleston sc women masturbate www.allteens.com soffioni faye valentine breasts scuba diving licence light plate online paintball video w3 search engine main edwin mccain music videos sued by the debt collector trailer park boys video clips index jpg last modified movie name jaime hammer video narnia movie 2005 cuban ass medical sales rep salary good sex commercial real estate listing listen lose yourself 360.15 marine aquarium 2 registration code search the web for ringtone kelly clarkson video because links washington dc tours illinois tax certificate power rangers spd movies solo girl videos david lynch ringtones extreme messenger serial number unforgetable song scandal video skatevideos top 5 diet pills absynth 3 serial number national education association list of new movies for 2005 shark tails movie striping girls fetish porn ativan toxicology sonic the hedgehog the movie download 80s hard rock radio australian escorts forum enable dht network lovely rivals movie air buy line ticket anne stedman norton internet security 2005 crack serial patch animal picture administration government name us veteran http stop aging long sex video sample process automation technologies picture of the movie big daddy movie theaters in wichita falls enrique iglesias escape hp wheel fat boy slim mp3 tsunami report for kids web provider showrooms canada trader link deer valley utah america on attack tamiya bruiser for sale italian tradition share photos free rca to s video cable private teen video shoppers advantage link quarry movies audio dvd creator 1.90 crack activation xp home post apocalypse movies http online pharmacies phentermine xenical meridia webmap kimi raikkonen video lotus smartsuite 9.7 crack actor movie western norvasc 5mg side effects filing bankruptcy ameron pirate slang dictionary movie review ratings big boys mocking bird by eminem video pastillas xenical aol com content music video nylock nut dimensions www.thumbzilla.com net teller chatt sex cam picture vagina video allwebmenu crack simplify reason 2.5 cracks cost of living calculator ddg latest tamil movie video songs glamour shots female in indianapolis movie moving in chicago pearl jam jeremy video verlihub commands wife committed suicide teens in short skirts galleries attorney colorado website alcohol and drugs in the workplace gorgeous quicksilver audio and video enhancer euro dollar conversion aggressive vs assertive behavior car amp repair brianne drouhard tom lewis quinn insurance manchester warren richardson munch munch munch betters a bad movie net reactor torrent site flame graphics illustrate 5.3 crack free lg3200 ringtones marble falls texas real estate reggaeton music video metformin dose fish tank supplies www aladdin the movie cast parthanon chicago accutane treatment mpeg4 videos drums ti 89 calculator manual advanced registry doctor serial number vivarium obtaining a contractors license youth council for ni unerasable pen madrus movie page amazon movie rentals manele video i860 download ringtones rebel flag license plates kevin smith movie list naked indian actresses lan search pro serial laser engraving equipment roller pigeon video ketex drug rowdy video nichole sheridan movies site lips alicia machado nude video neil site estupidos videos killswitch engage music video the fat flush here linear motion slides adderall bruising side effect arabian babes nude raggedy ann movies el chupacabra norel dm drug creative health products microsoft video editor monkey dance video movie theater palo alto 2006 carlo monte rally video star fury torrent av cable s video licensed vocational nurse program houston instant gay videos.com web rhinocam regal movie theatre oaks pa software engineer ii website converting from adderall to ritalin zipcode search license linux protection sdk software agente inmobiliario licenciada john cena movies to let in london links lewis martin movie cornish rex beautiful bikini women wired coffeehouse evansville in ev nova serial generator acid music 5.0 serial patenthunter crack full body massage orientation pearl video age of mythology nocd v1.4 lawnmower parts pinnacle systems studio 700 paul rodriguez jr video santana smooth video bob marley quotes calculus help tabatha cash zurich capital holdings inc painting kitchen cabinets addiction drug rehab treatment goji juice klonopin half life hairloss medication sites amc movie watchers useless 2b dementia free radical medical license numbers guided tours ciara goodies lyrics i love you art pictures eyes have hills movie review more sites for music videos crt paperless office oracle license and services agreement integrated video motherboard russian lesbian video beyonce mp3 journeys aarti drugs ltd news www style hyphen amateur couple home movie porn sluty free model pics beauty american african tips movie edit pro download turbocharger parts girls chat room papa dont preach video madonna map rise of nation torrent bottle cunt martin luther king speeches video lucky boys confusion music video military compass kyocera ringtone s14 oca movie moms.com teal neimanmarcus.com site honky tonk innsbrook after hours outkast caroline video easy cake recipes from scratch silver bullet movie nevada state contractors license board inguinal hernia sign and symptom slave slut biodiesel grants knight movies sponebob movie salicylic acid one night china torrent permutation groups manga girl drawings smoke video water link bang bros video veterinary technician salary canada paparazzi celebrities watson drugs www free virgin mobile ringtones.com movieland notifier euthanasia legal arctic cat atvs mum green grass of tunnel video online gun auctions spot coolers illinois license renewal secretary state donny hathaway neil walker pittsburgh pirates north dakota books marketa janska video frisbee golf courses links mens clogs acetaminophen codeine tablets 303 l0phtcrack 4.0 download lower back pain treatment long term auto storage parabens business card builder 5.0 crack adopt a highway programs doll clothes patterns ippo manga bittorrent preteens in panties san diego health care jobs always feel like someone is watching me lyrics as career pharmacist oxycontin street name pirates of the carribbean dead mans chest maneesha sharma shinedown ringtone samantha murphy adobe acrobat 6.0 serial number langston hughes authority hawaii tourism caballeros del zodiaco real estate paper japanese movie clip business voice mail systems shriek 3 webmap premier production wrestling video what is carisoprodol for song from movie closer queensborough community centre economic indicators gdp prado art museum in spain jack frost movie songs url bomis home license agreement sample blue monday sperm eating movie columbo movie gaffs truck conversions east coast vacations walmart cable audio microsoft activation number nokia 6600 mp3 player cracked descriptive statistics adapter rbg s video 1989 chevy caprice for sale sloth animal video loretta lynn video jack white martin bashir michael jackson video homepage adipex order cod url group sex virgins stacys mom music video download funny baby link charlaine harris petra verkaik video download my little eye movie review plastic video cases tennessee real estate for sale men mooning enterprise architect sparx crack 1000 day ericsson free k300a ringtone sony mid west national life insurance co of tn james clarke ross ringtone t290 social distortion music video codes alyssa milano nude video clip addicting computer download game game game game gametax.com video third symphony james barnes snake charmer video ladies with big bosoms ipod photo video playback medical billing software programs realproducer plus 10 crack anal fucking free download movie map inspirational wedding poem medical licensure metro pcs nokia 3205 ringtones glutamine protects the kidneys from acetaminophen adult baby diaper photos porno good quality lanyards jack dempsey mercedes benz parts motorcycle video camera mounts always music side video award winning movies 2003 automatique location video pictures of the eiffel tower in paris france prostate milking videos jill-kelly texas tech kappa alpha magic tan most popular video games of all time empresa.asp lindsay lohan boobs ayn rand book titles girl scout patches girls nicknames new york counties stryper music video url mase what you want video adderall xr depression sorority boys adderrall and adderall kr roger ebert great movies ii junkyard guitars royal oak kinds of enzymes father daughter dance sites alabama auburn in land sale james vanderbeek movies feeldoe slim vibrator weekend getaway web body type john deer american farmer no cd patches d-mannose ecoli arizona athletics.com joint operations escalation cd key crack blue streak muff dive movie pump it up dance video www american reject video avg 7.0 license number crack hoodia diet pills website free cell phone ringtone game emo video codes marriage licenses in nebraska a racing car houses for rent marthas vineyard nj licence plates priv busty brits wallpapper azeureus bittorrent free pantyhose gallery when i get there lyric drill chart manly men bsc watson.microsoft.com spider man 2 movie poster mla writing style morris county homes for sale seattle washington homes why to date a dancer lesbian drawings robot devil eurotrip movie unrated big fish fashion shoes srs wow xt crack url sex slang fat gay men kitty girl cell cellular link phone ringtone us world.t35.com youngstown convocation healthcare job listings pc games torrents download movie script superstar http parachute cord uk night on earth torrent amateur eat free movie sperm kanye west workout plan video metal halide lights best of my love australias funniest home videos 2005 trophy wife http hard cum location movie times at the dolphin bay movie musicals on video professional video editing equipment microsoft word 2000 cracks homemade anal sex toys mytheatre 3.21 crack nfl football video clips franklin high school 810whb inuyasha and kagome ever kiss abit video cards audio and video 2001 find a person phone number sql random order porsche cayman susie curry mtv movie awards 2005 star wars emailchemy crack mickey mouse monster movie paradisus hotel mexico domain tylers room lenticular clouds matrox dual video tony bowden wicker bedroom furniture john holmes movie downloads first man in space ass big movie sex domain wrestling photos mp4 free videos eminem ass like that video codes inspirational quotes about death http onyxia raid movie discount hydrocodone scorpio traits domain samsonite briefcases nation p.o.d video youth obscure movie facts pirated programs movie realese movie where playing ramon dekkers video clips naomi robson legoland california home nadia bjorlin porn section video top ten mattresses silvia fominaya video intenso project video clip fosamax or actonel missoula movie theatres love generation video star movies india shedule resnick video dui acp poirot links learning drum kit movie wolf creek 25th anniversary decorations cute teenage boys indesign mac torrent teen lesbo hair perm overboard movie quotes page pacific heroes license key martin luther king dream video speech electric slide video download kylie teen videos live cd torrent bagel company nokia 3120 ringtones free pierce brosman movies mini cooper movies ascii art pee drinking videos free ringtone vx3300 sachin movie stills executive movie summary theater drop kick murphys industrial videoscope mask of fu man chu movie on-line stock photography norton manx download jungle ringtones deer hunting outfitters mary kate and ashley olson paris movie lst girl squirting office xp cd key serial debt reduction forms nice tight butt netflix movie placa de video para pc 2006 chevrolet cobalt ss supercharged philips 30 inch integrated hdtv suzuki marauder avian flu tamiflu warehouses sybil movie sally fields st barths charter legal drugs high eves gift movie treacherous pentax optio wp risperdal consta drug website voyeur neighbor anal arc cum free movie sex shot arsenic lace movie old uaru forum x box morrowind vampiric ring appleseed movie arkansas toyota dealerships silsila movie amped mobile bottle insertion paige sinclair advanced auto part virgin gorda wildnerness lodge wisconsin dells adam gay video directory commercial loan officer jdm insider torrent elisha cuthbert videos dump trucks for sale angel de khriz video y midwest mandi praise and worship videos paris hiltons x rated movie pa driver license centers economizer controls sharp alpine village inn deep creek mallinkrt pharmacy sweet text message off roading video leave and licence agreement jordan landing utah movies indium tin solder surinam the gap band mp3 sig tags endi magic kingdom movie foster nuclear weapons testing video angel tattoo galleries movie soundtrack torrent http advanced technology video american academy of pediatric committee on drug secure digital flash memory card scissor sisters music video titanime 2004 ford f 150 stx metal gear movies manga read online palm beach real estate electric slide dance history t mobile polyphonic ringtones windshield avi to vcdsvcddvd converter v2.48 crack domain pharmacy technician exam review alcohol 120 cracked version german wirehaired pointer ortho novum 777 drug domain carpet franchise mays music store prey video insaniquarium crack code black babe compliance consultant mainly tea wethersfield ct links columbine high school shooting sea isle summer rentals gay gloryhole south west aim music video pirate of penzance picture nick berg video lord of the g strings cast pubic hair removal nc dmv license plates site mexico pharmacy adderall new york doll tab page john barleycorn stronghold 2 game download women wrestling groped girls party sex sex sex lo mejor de mi vida 200 free ringtone sanyo scp lonely no more real videos clips overnight phentermine no prescription thierry henry champions league link martha higareda group ice breakers power of chaos crack fashion advice howard hughes pictures language conversion illinois secretary of state and business licenses lolo ferrari gallery everytime jesus loves me porkys movie texas rangers tickets last minute vacation packages rutland vt movie theater page avi e erotici in mpeg video free lg mp3 ringtone vx6000 loverboy movie trailer cooking.com jack off videos trina music videos heated eye lash curler kates playground galleries australian surfer boys advanced cataloguer pro crack smith drug company texas big bums blank emblems url movie themed party marky mark and the funky bunch music video the oak in ojai madonna vogue music video raven riley videos bedding ensembles curves for woman panty poop compost bins site letter requesting transfer writing one tree hill 213 torrent iron byron video annual association correspondent dinner house video white ls50 8 review licensing definition women like their pussy ate private gladiator torrent plattsburgh state hockey url inside the vip video rain city video home clackamas real estate savannah restaurant gift certificate television harmful to children manufacturer representative group tucson mountain park angelas ashes movie review 18galls american journal of cardiovascular drug jazz clearwater mira mesa movie theater movie clip free kama sutra alzheimers disease drug treatment domain lesbian video previews free la marseillaise ringtone epps married omar eagles victory song ringtones imtoo dvd ripper 4 crack the love song jeff bates lyrics movie that are out now advanced cataloguer pro serial free couples fucking galleries myelin oligodendrocyte http accepted in movie name school link sister morphine records servuftp excercise video reviews joy division movie jude law external fixation of fractures penis enlargment pregnancy for dummies video web web host reseller url petey video williams http munsters video clips serial print server hp aliagas nikos video recipes for chicken enchiladas home building loans in a fix tv show homepage metroid prime ending movies just say no to drugs posters aziani movie nwa wrestling videos old young movies domain proquest product licenser home xbox light gun iso buster 1.7 serial number zoe anderson obsessive compulsive disorder drug mississippi car insurance rate angelina jolie videography meteor video eisley telescope eyes video download lori loghlin runescape trainers ms office 2003 activation kelly monaco photos jokes.com video mapquest.ca mohegan sun now playskool video durk pearson nickelodeon 3d movie maker download license michigan verify license microsoft com http movie price ticket vancouver rat pack slang etrusco washington dc menu pussy galleries imtoo dvd ripper 2 crack gps signal distribution lotr funny video styrofoam materials sexy animation movie movie coach carter download predator videos released mummy the ride video the game mp3 ringtone home flashing biker chicks jameson jenna online video 1800s map of north america url photograph video code series of unfortunate events magnetic body lights elcard mpeg 2 video decoder sense of smell paintball grenade videos silvercity movies gloucester dehumidifiers kfmb jubal movie imitrex injectable no prescription kannada video songs download savings bank life insurance espelir jgt500 exhaust opm3 atlanta black crackers video de los simpsons medal of honor crack no cd ortho try cycline lo sin city official site movie ataxin drug pen tapping video lynyrd skynyrd red white and blue lyric examples of a cover letter for a resume brand identity webmap allie sin movies top www indian polyphonic ringtone download rey mysterio video free pirate flags and their meanings tracy lord princess blueyez movies teen lesbos indian xx movie lsa glassware uk krumpers video rent an rv my little pony video clips shooting targets naturist home video popular sovereignty off road race video web roubens pharmacy ps2 shinobi torrent movie optoma time amateur foto privados video y kentucky professional engineering license adobe indesign cs serial numbers eviction notice sample texas free verizon lg 3200 ringtones home lentus drug news hour video harvard medical school showbiz videos website movie parody posters american steel buildings auto license plate old hairy men web borg warner turbocharger mysore mallika video stick it where the sun dont shine movie my place video nelly accessory aftermarket aztek part pontiac amg-lite real estate appraiser licensing california anime school girl hot fucoidan april little movie porn teen make torrents go faster more technology infrastructure plan nina mercedez video v600 mp3 ringtones music selenas video url air sea tower page i dont wanna know if youre playing me booth babes teen drunk audio conversion software england a la z boy company alanna web jessica simpsons medical educational video ringtone for motorola c450 aim robots sandals resort jamaica web new york cuisine art kane jazz photo the war in vietnam vietnam travel search homes for sale sitemap paris hilton lesbian sex video napolean dynamite soundboard manchester united video downloads martin movie steve story sites anxiety cordova rancho social inspirational quotes star password ultra video xxx catalpa tattoo supplies online marik childrens language books tim westwood show pat langley stanford ledger sheets jameison mae wet messy sex pearl jam review mirror found money like a prayer video simmons real estates adelaide increasing adderall strength movie xchange arlington unix hosting phrenology pulte jimmy kimmel show videos page natural 36c pantyhose nascar gift wal mart benefit ml rusk hair products taux banque immobilier armadillo sailor ball x chimeras gwen stefani holla url untapped teens easy blowjobs american racing torq thrust wheels snowboarding video clips online passed out girls movies infraganti shorewood apartments south indian masala video http bollywood ringtone for motorola canvas waterproofing smoke tree free verizon lg vx 3200 ringtone website movie spielberg transformer www website university of wisconsin badgers basketball schedule aloe liquid vera miniature camera lens silverseas jus truffe lapd she hates me web mario sperry videos apple movie trailersa phat pussy lips burj al arab koury natatorium asian tsunami video clips a1gallery movie music video for xangas nobody knows movie trailer talking heads once in a lifetime ukrops pharmacy rome total war bittorrent download tree clipart eddies million dollar cook off kaye mccracken lynyrd skynyrd music video codes name a tom hanks movie america grossing movie time top old video games for sale puggles for sale rumors lindsey lohan video animated animal videos jordan capri torrents antonio in movie san theatres sex movie review samsung sgh e105 ringtones looking make natural tip up redhead movie post www increasing hgh naturally scooter video ny gay personals rome total war wwf wrestling figure marriage license certificate aire tomcat kayak microsoft office 2000 professional serialz site shark tales superman the movie 2006 load error no dpmi memory pharmacy schools in united states of america aol musicvideos com teenager sex university of madras ice mca result ogaden desert map atlantis quest crack donnie russo free butt pictures timmy mccartney biography situation vacant nz time share portugal 9 to 5 orgasm tips for women dalene curtis lakeland ledger spears video do somethin tony kornheiser show xm radio tercio de armada spiderman 2 movie script website im not okay i promise video download gravedigger nokia phone activation sri lanka music video rsx turbo videos training companies penis length hairy muff lethal weapon movies web daddy yankee ringtone drug abuse can adderall get you high here aed tools serial rammstein videos keine lust ship planner sheepskin slippers ceramic animals m1989 atl movie official site 2002 degree film spielberg steven domain monica mayhem shadow art skate shop halo-multiplayer-map domain oviedo mall movies aisha video imovie tutorial online home movie theater columbia md law order svu video henry eleazar elias howe sitemap maine pyaar kiya movie license plate decals music video piano memphis real estate agencies using drugs in sports military stud photoshop trial expired crack movie night basket lol ride movie quote star war download free online movies highway patrol enchanted unicorn video slot download sdms 128 822 movieland 8 cheektowaga ny massivecockvideos.com star movies schedule web gay bear muscle used defibrillators brittany nude video duplicator link anticancer drug design journal tales imovie idvd lines mushrambo torrent uv water purification motoras video scott wills breakdance video url matador video branson missouri shows local movie theater times cum covered faces netnanny crack lemonade tycoon 2 crack 2000 superbowl star of the county down rugby clothes ralph lauren link inscription of mother teresas tomb mexico travel packages plastic scale models star wars spoofs salvatore ferragamo alejandro sanz videos arash boro boro video clip aphex twin come to daddy video clip words that rhyme with met scariest moment in movie mcfly music video much music phone ringtones hottest porn home s video to rca pinout papo vazquez pirate troubadours japanese rental video fake rolex index burster home garden anime bittorent downloads reiko azechi 1960 fashion one minute comedy monologues alabama driver license division bisexual men domain free mp3 ringtones for motorola e398 fleetwood mac everywhere ama videos domain sandi patti print studio 2.0 crack pa golf courses funny cell phone ringtones dildo cam morganna the kissing bandit tube top dress kacheek watching women undress photoshop elements us postal service retirement benefits avet reels amortization schedule expired drivers license illinois yucko the clown grady sizemore aurora loan services i sound wma mp3 recorder 6.53 crack rambling sid rumpo lyrics jamal lewis drug signs movie poster universal soldiers movie top charles smashing pumpkin zero video leadership and organizational analysis annie hall movie quotes miniature dappled dachshund temple bar dublin history here avast license file links way of the master speedo stories amateur bondage hot anime lesbians website michigan builder licence america aol democracy invitation reminder audio and video technician jobs index making a music video swiss re life nevermore video nude ebony movie stars web movie in okc ampland movie links stipid videos.com america 39 s funniest video sex twin video shelton benjamin video pirates of the caribbean quotes

Contents

Platform Notes

strongSwan is an open source IPsec VPN solution that runs on Linux systems with either 2.4 or 2.6 kernels. The data encryption is handled by the Linux kernel (using KLIPS for 2.4, or Linux native IPsec for 2.6), and IKE is handled with a user mode process.

All versions support standard IKE (IKEv1) using the pluto IKE deamon. Recent versions (from version 4.0.0) also support IKEv2 using the charon daemon.

strongSwan was originally based on the FreeS/WAN product, which is no longer being maintained. Here are the IKE details for FreeS/WAN.

OpenSwan is a similar open source Linux IPsec VPN product, which was also based on FreeS/WAN. Here are the IKE details for OpenSwan.

Version History

There are currently two strongSwan branches: the stable 2.x branch, and the development 4.x branch.

The first strongSwan version was 2.0.0, dated March 2004, which was based on FreeS/WAN 2.04 plus X.509, NAT Traversal and AES encryption patches.

strongSwan 4.0.0, dated May 2006, was based on strongSwan 2.7.0.

In addition to the releases on each branch, the latest code is also available via CVS.

Backoff Pattern

IKEv1 with pluto

With IKEv1 using the pluto daemon, strongSwan has the backoff pattern

0, 10, 20

This pattern is also shared by FreeS/WAN and OpenSwan because all of these are based on the FreeS/WAN pluto daemon.

Below is an example from strongSwan 4.0.5 running on Debian Linux:

$ ike-scan -M --showbackoff 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=a997321d37e9afa2)
        SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

IKE Backoff Patterns:

IP Address      No.     Recv time               Delta Time
172.16.3.18     1       1171468498.860140       0.000000
172.16.3.18     2       1171468508.869134       10.008994
172.16.3.18     3       1171468528.888169       20.019035
172.16.3.18     Implementation guess: Linux FreeS/WAN, OpenSwan, strongSwan

IKEv2 with Charon

With IKEv2, using the charon daemon, strongSwan does not do any re-transmission. Below is an example from strongSwan 4.0.5 on Debian Linux. Note that there is only a single packet in the pattern, indicating no retransmission is being performed by the strongSwan server.

$ ike-scan --ikev2 -M --showbackoff 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     IKEv2 SA_INIT Handshake returned
        HDR=(CKY-R=543caf8e5aa2f2fd, IKEv2)
        SA=(Encr=AES_CBC,KeyLength=128 Integ=HMAC_SHA1_96 Prf=HMAC_SHA1 DH_Group=14:modp2048)
        KeyExchange(132 bytes)
        Nonce(16 bytes)

IKE Backoff Patterns:

IP Address      No.     Recv time               Delta Time
172.16.3.18     1       1171468775.120626       0.000000
172.16.3.18     Implementation guess: Linksys Etherfast

Vendor IDs

strongSwan 4.x returns two Vendor IDs in the first responder packet under IKE Main Mode:

  • strongSwan VID (MD5 Hash of "strongSwan 4.x.y", where x.y is the minor version number)
  • Dead Peer Detection VID (afcad71368a1f1c96b8696fc77570100)

Because the strongSwan VID is a hash of the version number, it can be used to identify the exact version of strongSwan.

The example below shows the Vendor IDs returned by strongSwan 4.0.5 on Debian Linux:

$ ike-scan -M 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=376ab8a5bb2f443d)
        SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Authentication Methods

strongSwan supports Pre-Shared Key and RSA Signature authentication methods.

The method to use is defined by the authby configuration option, which can take values of secret for Pre-Shared Key or rsasig for RSA Signature.

RSA Signature Example

In this example, we don't specify an authentication method in ipsec.conf so the default of RSA Signature is used. We need to use the --auth=3 option to ike-scan to specify RSA Signature authentication.

conn iketest
        left=172.16.3.18
        leftsubnet=172.16.3.0/24
        right=%any
        auto=add
$ ike-scan -M --auth=3 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=d0cc0abad9d372fe)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Pre-Shared Key Example

In this example, we specify Pre-Shared Key authentication in ipsec.conf with authby=secret.

conn iketest
        left=172.16.3.18
        leftsubnet=172.16.3.0/24
        right=%any
        authby=secret
        auto=add
$ ike-scan -M 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=2fe7d819d2601f44)
        SA=(Enc=3DES Hash=SHA1 Auth=PSK Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

ISAKMP SA Lifetime

Lifetime in seconds

strongSwan accepts either no SA lifetime in seconds (i.e. the attribute is not present), or a value in the range 0 to 86,400 seconds (24 hours) inclusive. Values outside this range result in a NO-PROPOSAL-CHOSEN message. The examples below illustrate this behaviour:

$ ike-scan -M --lifetime=none --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=5a3610d1cdff1dea)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
$ ike-scan -M --lifetime=1 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=6e7acddc8cdf90ef)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00000001)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
$ ike-scan -M --lifetime=86400 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=4f65b272c6f96be8)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00015180)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
$ ike-scan -M --lifetime=86401 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=43bbf79744a6b00b)

strongSwan accepts a variable-length lifetime sttribute with a seemingly arbitary value length, providing the value is within the acceptable range. This has been tested up to value lengths of 256 bytes. The example below shows the response to a lifetime in seconds value of 1 encoded as a variable length attribute with 32 bytes. The lines have been wrapped to aid readability:

$ ike-scan -M --lifetime=0x0000000000000000000000000000000000000000000000000000000000000001
  --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=1c6eb126df6bff64)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds
            LifeDuration(32)=0x0000000000000000000000000000000000000000000000000000000000000001)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Lifetime in Kilobytes

strongSwan supports any SA lifetime in Kilobytes, including none at all. There appears to be no upper limit to the SA lifetime. It also supports both lifetime in seconds and lifetime in kilobytes together. The examples below illustrate the behaviour:

No lifetime in seconds, zero lifetime in kilobytes.

$ ike-scan -M --lifetime=none --lifesize=0 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=fe75d62f5cbc9c7a)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Kilobytes LifeDuration(4)=0x00000000)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

A lifetime of 1 kilobyte.

$ ike-scan -M --lifetime=none --lifesize=1 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=2aea9f0807ce816d)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Kilobytes LifeDuration(4)=0x00000001)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

A huge lifetime in kilobytes. 0xffffffffffffffff is about 1.8x10^19.

$ ike-scan -M --lifetime=none --lifesize=0xffffffffffffffff --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=d76d428d5e5e56e8)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Kilobytes LifeDuration(8)=0xffffffffffffffff)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

A huge lifetime in kilobytes with the maximum permitted lifetime in seconds.

$ ike-scan -M --lifetime=86400 --lifesize=0xffffffff --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=c4a08a38583a9f3b)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00015180 LifeType=Kilobytes LifeDuration(4)=0xffffffff)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Transform ordering and rewriting

strongSwan generally returns the transform attributes in the order that they are supplied by the initiator.

In the example below, we specify the four mandatory transform attributes in order Enc, Hash, Auth, Group and then in reverse order Group, Auth, Hash, Enc, and observe that the target returns the attributes in the same order as the initiator specified them.

$ ike-scan -M --trans="(1=5,2=2,3=3,4=2)" 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=9d2b3e904a3ab3e1)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
$ ike-scan -M --trans="(4=2,3=3,2=2,1=5)" 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=d9f5aec66242df7e)
        SA=(Group=2:modp1024 Auth=RSA_Sig Hash=SHA1 Enc=3DES)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Here is another example, this time including a lifetime in seconds, and a lifetime in kilobytes. Again, the attributes are returned in the same order that the initiator sent them.

$ ike-scan -M --trans="(11=2,12=123,11=1,12=456,4=2,3=3,2=2,1=5)" 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=c53786f9985fea68)
        SA=(LifeType=Kilobytes LifeDuration=123 LifeType=Seconds LifeDuration=456 Group=2:modp1024 Auth=RSA_Sig Hash=SHA1 Enc=3DES)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

strongSwan 4.0.5 (and maybe other versions as well) requires that the keylength attribute follows the encryption algorithm attribute when variable length ciphers are used. Below is an example using AES-128. In the first example the attribute ordering is DH Group, Auth, Hash, Enc, Keylen, which works, while in the second it is DH Group, Auth, Hash, Keylen, Enc which doesn't work and returns NO-PROPOSAL-CHOSEN.

$ ike-scan -M --trans="(4=2,3=3,2=2,1=7,14=128)" 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=dcf1c29da6a493c5)
        SA=(Group=2:modp1024 Auth=RSA_Sig Hash=SHA1 Enc=AES KeyLength=128)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
$ ike-scan -M --trans="(4=2,3=3,2=2,14=128,1=7)" 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=7e2ea4c1f76657c8)

Aggressive Mode

strongSwan does not support IKE Aggressive Mode. If you try to use aggressive mode, it replies with an informational exchange containing notify message 29 (UNSUPPORTED-EXCHANGE-TYPE) as illustrated below:

$ ike-scan -A -M 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 29 (UNSUPPORTED-EXCHANGE-TYPE)
        HDR=(CKY-R=0000000000000000)

This means that remote access connections where the initiator's IP address is not static cannot use pre-shared key authentication, and must use certificates instead. This is because Main Mode cannot be used with Pre-Shared key authentication when the initiator's IP address is not known in advance.

Response to non-compliant and malformed packets

In all the examples below, we specify a single transform. Except in the case where we are deliberately specifying an unacceptable transform, the attributes are Enc=3DES, Hash=SHA1, Auth=RSA_Sig, Group=2, which is acceptable to the target system.

Except in the unacceptable transform case, the responder cookie is always zero when reporting an error. This is similar to CheckPoint Firewall-1, except that CheckPoint responds with a zero cookie in all cases.

In general, strongSwan responds to invalid packets by sending a notify message, and it uses the notification message that would be expected.

No Acceptable Transforms

strongSwan will return notify message 14 (NO-PROPOSAL-CHOSEN) if the Encryption Algorithm, Hash Algorithm, or Diffie-Hellman group is unsupported. However it will not respond at all for an unsupported Authentication Method.

The example below shows the response to a single transform where the encryption algorithm is set to DES, which is not supported. All other attributes are supported.

$ ike-scan -M --trans=1,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 14 (NO-PROPOSAL-CHOSEN)
        HDR=(CKY-R=cf677d98bff73747)

Bad IKE version

$ ike-scan -M --headerver=0x30 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 5 (INVALID-MAJOR-VERSION)
        HDR=(CKY-R=0000000000000000)
$ ike-scan -M --headerver=0x11 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 6 (INVALID-MINOR-VERSION)
        HDR=(CKY-R=0000000000000000)

Invalid DOI

Given the other responses, I would have expected strongSwan to respond with notify message 2 (DOI-NOT-SUPPORTED) rather than message 16 (PAYLOAD-MALFORMED).

$ ike-scan -M --doi=2 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 16 (PAYLOAD-MALFORMED)
        HDR=(CKY-R=0000000000000000)

Invalid Situation

$ ike-scan -M --situation=2 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 3 (SITUATION-NOT-SUPPORTED)
        HDR=(CKY-R=0000000000000000)

Invalid Initiator Cookie

$ ike-scan -M --cookie=0000000000000000 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 4 (INVALID-COOKIE)
        HDR=(CKY-R=0000000000000000)

Invalid Flags

Given the other responses, I would have expected strongSwan to respond with notify message 8 (INVALID-FLAGS) rather than message 16 (PAYLOAD-MALFORMED).

$ ike-scan -M --hdrflags=255 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 16 (PAYLOAD-MALFORMED)
        HDR=(CKY-R=0000000000000000)

Invalid Protocol

$ ike-scan -M --protocol=2 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 10 (INVALID-PROTOCOL-ID)
        HDR=(CKY-R=0000000000000000)

Invalid SPI

$ ike-scan -M --spisize=32 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 11 (INVALID-SPI)
        HDR=(CKY-R=0000000000000000)

Non-Zero Reserved Fields

$ ike-scan -M --mbz=255 --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Notify message 16 (PAYLOAD-MALFORMED)
        HDR=(CKY-R=0000000000000000)

Nat Traversal

strongSwan supports RFC 3947 NAT Traversal, but only if it is enabled with nat_traversal=yes in the config setup section of ipsec.conf. If it is not enabled, then strongSwan will not respond to NAT Traversal encapsulated packets.

Here is an example of a NAT Traversal response.

$ ike-scan -M --nat-t --trans=5,2,3,2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=f784c6ecc962e297)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)

Here is another example, this time specifying the NAT Traversal Vendor ID, which is then included in the response.

$ ike-scan -M --nat-t --trans=5,2,3,2 --vendor=4a131c81070358455c5728f20e95452f 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     Main Mode Handshake returned
        HDR=(CKY-R=94f22001c70308c6)
        SA=(Enc=3DES Hash=SHA1 Auth=RSA_Sig Group=2:modp1024 LifeType=Seconds LifeDuration(4)=0x00007080)
        VID=dd180d21e5ce655a768ba32211dd8ad9 (strongSwan 4.0.5)
        VID=afcad71368a1f1c96b8696fc77570100 (Dead Peer Detection v1.0)
        VID=4a131c81070358455c5728f20e95452f (RFC 3947 NAT-T)

IKEv2

strongSwan version 4.x supports both IKE and IKEv2. Here is an example IKEv2 response from a strongSwan 4.0.5 system running on Debian Linux:

$ ike-scan -M --ikev2 172.16.3.18
Starting ike-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/ike-scan/)
172.16.3.18     IKEv2 SA_INIT Handshake returned
        HDR=(CKY-R=35eafcd831ba1227, IKEv2)
        SA=(Encr=AES_CBC,KeyLength=128 Integ=HMAC_SHA1_96 Prf=HMAC_SHA1 DH_Group=14:modp2048)
        KeyExchange(132 bytes)
        Nonce(16 bytes)

The configuration entry from ipsec.conf on this system is:

conn iketest
        left=172.16.3.18
        leftsubnet=172.16.3.0/24
        right=%any
        keyexchange=ikev2
        authby=secret
        auto=add

Remote Access VPN Client

strongSwan does not include a remote access VPN client. However, it should work with generic VPN clients such as SafeNet because it does not use any proprietary mechanisms.

Other Interesting Behaviour

Zero responder cookies in most notify messages

When a strongSwan system responds with an informational exchange containing a notify message, indicating an error condition, it sets the responder cookie to zero unless the notify message is NO-PROPOSAL-CHOSEN.

This is similar to CheckPoint Firewall-1, but with CheckPoint the responder cookie is zero for all notify messages.

Default Configuration

By default, strongSwan 4.0.5 supports the following transform attribute values:

Encryption Blowfish, Triple-DES, AES-128, AES-192, AES-256, Serpent and Twofish
Hash MD5, SHA1, SHA2-256 and SHA2-512
Authentication RSA Signature (optionally Pre-Shared Key)
DH Group 2, 5, 14, 15, 16, 17 and 18

This is a very impressive set of supported attribute values.

As described in the Authentication Methods section above, the default method is RSA Signature, but Pre-Shared key can also be specified.

No weak ciphers are supported by default. In particular there is no support for single DES or Diffie-Hellman group 1.

It is interesting to see support for the newer MODP Diffie-Hellman groups 14 to 18 from RFC 3526, and also the new SHA2-256 and SHA2-512 hash algorithms.

It's unusual to see support for AES-192. Most implementations restrict themselves to AES keylengths of 128 or 256.

Blowfish, Serpent and Twofish are very unusual.

Serpent and Twofish use the values 65004 and 65005 respectively, which are outside the IETF allocated range for encryption algorithm values. It is not known if this will interoperate with other vendors because I've not observed any other product that offers Serpent or Twofish.

It is possible to restrict the attributes that strongSwan will accept with the ike configuration entry. E.g. ike=3des-md5! would only allow 3DES encryption with MD5 hash. The exclamation mark at the end of the cipher list specifies that only this list is acceptable.

Discovered Vulnerabilities

Personal tools